A federal effort to help a big new medical research project collect Americans’ medical records quickly could make it easier for insurance underwriters to get the records.
The effort could also increase the workload of health plan administrators, by encouraging consumers to ask health plans to send health records to other parties.
The U.S. Department of Health and Human Services Office for Civil Rights (HHS OCR) gives guidelines for sending health records to third parties in a new batch of advice based on Health Insurance Portability and Accountability Act (HIPAA) health records access standards. HHS OCR released those standards in January.
HHS OCR officials say an individual has a right to have a health care provider or a health plan send protected health information (PHI) directly to a third party. The third party could be a health care provider; a research team; an insurer that offers life, disability or long-term care insurance; or any other designated individual or entity.
The consumer has that right through the HIPAA right of access provision, HHS OCR officials say.
In the past, a patient could use a HIPAA authorization process to get a provider or plan to send health records to a third party.
The HIPAA authorization process requires the patient to fill out a relatively complicated form, and it imposes no deadlines on the entity sending the information, officials say.
When a patient uses the HIPAA right of access to get an entity to send health records to a third party, the patient simply has to make a request in writing, sign the request, and indicate where the entity should send the information, officials say.
Under the HIPAA right of access standard, the entity sending the health records must send the records within 30 days, officials say.
The HIPAA right of access standard applies to billing records, payment records, claim records, health plan enrollment records and case management records, as well as health care provider medical records, officials say.
The right excludes some types of records, such as psychotherapy notes, provider peer review files and provider performance evaluations, officials say.
The right of access applies even if information is very old and is stored offsite, officials say. The grounds for denying access to health information “do not include the age or location of the information,” officials say.
Elsewhere in the guidance, officials emphasize that the entities sending the records can charge only a “reasonable, cost-based fee” for the “labor, supply and postage costs” associated with making the copy.
An entity that uses an outside company to handle health records requests can still charge for copying and mailing health information, but it cannot charge any extra administrative fees or other extra vendor-related fees, officials say.
The Obama administration has taken an interest in the subject because of patient complaints about difficulties with getting health records, and because the managers of the Precision Medicine Initiative are trying to create a large database of genetic and health care records information. Project leaders say they want to develop new strategies for tailoring health care to suit a patient’s genetic profile.
Are you following us on Facebook?